I migrated a leap 15.6 system to slowroll. The problem I cannot solve is how to have Network Manager connect to our DHCP server and get its ipv6 address.
I tried enabling and (re)starting wickedd. (That was a winner in 15.6.) I do get ipv6 addresses; not any of the ones from the DHCP server, either static or dynamic.
This all worked nicely in 15.6.
Since you mentioned DUID and IAID, is your DHCPv6 server using a MAC-address reservation, or is the reservation based on the DHCPv6 DUID/IAID? Who administers the DHCPv6 server - is it your server, or is it managed by someone else?
Just in case this helps…
You can try
nmcli connection modify "<connection>" ipv6.method dhcp nmcli connection up "<connection>"
If the server reservation is based on DUID/IAID, and the conneciton fails, you can check the identifiers configured for the NM connection with
nmcli -f ipv6.dhcp-duid,ipv6.dhcp-iaid connection show "<connection>"
Those are the values your DHCPv6 administrator can use to check the reservation.
IPv6 mostly relies on SLAAC or RA. This is the main thing people get wrong about most common ISP configuration.
Use radvdump to monitor RA prefix broadcasts, this will be helpful to verify its passed on. If you get a prefix on RA then you’re very close to being connected.
DHCPv6 is a thing on the router usually, not the client.
It is based on DUID/IAID.
I do.
In the past when the DUID/IAID was changed by an upgrade (grrrrr), I could obtain the IDs by seeing which new dynamic IPs were assgined and using thhe data provided there.
This has not happened with this upgrade. Hence my query.
I tried that with Cockpit, changing from “automatic” to “automatic (DHCP)”. All IPv6 addresses disappeared.
Please post the output from
sudo journalctl -u NetworkManager -b | grep -i dhcp
immediately after trying the connection (via NM) again.
If “Automatic” gives you IPv6 addresses, that suggests the network is providing IPv6 via RA/SLAAC? What does the router advertisement from your router look like?
$ sudo journalctl -u NetworkManager -b | grep -i dhcp
Sep 15 17:37:27 sma-station12l.sma.com NetworkManager[1556]: <info> [1789519047.0429] dhcp: init: Using DHCP client 'internal'
Sep 15 17:37:29 sma-station12l.sma.com NetworkManager[1556]: <info> [1789519049.9244] dhcp4 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 17:37:30 sma-station12l.sma.com NetworkManager[1556]: <info> [1789519050.2659] dhcp4 (eth0): state changed new lease, address=192.168.69.109, acd pending
Sep 15 17:37:30 sma-station12l.sma.com NetworkManager[1556]: <info> [1789519050.4200] dhcp4 (eth0): state changed new lease, address=192.168.69.109
Sep 15 17:37:32 sma-station12l.sma.com NetworkManager[1556]: <info> [1789519052.4203] dhcp6 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1781] dhcp4 (eth0): canceled DHCP transaction
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1781] dhcp4 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1781] dhcp4 (eth0): state changed no lease
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1783] dhcp6 (eth0): canceled DHCP transaction
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1783] dhcp6 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.1783] dhcp6 (eth0): state changed no lease
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.6059] dhcp4 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:05:04 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520704.8632] dhcp4 (eth0): state changed new lease, address=192.168.69.109, acd pending
Sep 15 18:05:05 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520705.0221] dhcp4 (eth0): state changed new lease, address=192.168.69.109
Sep 15 18:05:06 sma-station12l.sma.com NetworkManager[1556]: <info> [1789520706.3615] dhcp6 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7698] dhcp4 (eth0): canceled DHCP transaction
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7700] dhcp4 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7700] dhcp4 (eth0): state changed no lease
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7702] dhcp6 (eth0): canceled DHCP transaction
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7702] dhcp6 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:33:07 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522387.7702] dhcp6 (eth0): state changed no lease
Sep 15 18:33:08 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522388.0982] dhcp4 (eth0): activation: beginning transaction (timeout in 45 seconds)
Sep 15 18:33:08 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522388.3785] dhcp4 (eth0): state changed new lease, address=192.168.69.109, acd pending
Sep 15 18:33:08 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522388.5351] dhcp4 (eth0): state changed new lease, address=192.168.69.109
Sep 15 18:33:10 sma-station12l.sma.com NetworkManager[1556]: <info> [1789522390.0705] dhcp6 (eth0): activation: beginning transaction (timeout in 45 seconds)
I expect IPv6 addresses in the range fd2f:4760:521f:3f3c::c0a8:45xx/128.
This is typical of what I actually get: fd2f:4760:521f:3f3c:4a11:3369:7ca0:b046/64.
I do not know where these IPs originate.
No idea.
The journal shows NM is attempting DHCPv6, but it isn’t receiving a lease…
state changed no lease
Show
nmcli connection show "<connection>"
Also, since you administer the DHCPv6 server, can you check its logs while bringing the connection up?
(sigh) I cannot figure how to see the system logs in the Sonicwall firewall. There a lots of other log data to view.
The issue really seems to be with this host, not the server. Other computers have no problem receiving IPv6 addresses, both dynamic and static. And there was no problem for this host before the migration.
The journal listing indicates a timeout occurred. Likely the host is blocking the DHCP6 outgoing request, for … reasons?
aside: what do I put in the placeholder “<connection>”?
I mean the connection profile name. Use nmcli connection show and you should see something like
NAME UUID TYPE DEVICE
Wired xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ethernet enp3s0
In the above ‘Wired’ example, you can then do
nmcli connection modify "Wired" ipv6.method dhcp
nmcli connection up "Wired"
Given you say other hosts connect ok and this one doesn’t ( no DHCPv6 lease is received), a packet capture on eth0 is a very useful next step…
sudo tcpdump -i eth0 -vv 'udp port 546 or 547'
If tcpdump shows the DHCPv6 “solicit” leaving eth0 but no “advertise” coming back, then the problem is with the SonicWall/DHCPv6 side. You mentioned that you’re employing DUID/IAID reservation.
Use the radvdump command I suggested.
If you’re not seeing anything you need to figure it out. There are also sysctl values that need to be correct for RA to propagate, especially if behind VM or container.
14:25:09.806799 IP6 (flowlabel 0xee83f, hlim 1, next-header UDP (17), payload length 103) sma-station12l.local.dhcpv6-client > ff02::1:2.dhcpv6-server: [bad udp cksum 0xb45e -> 0x3bc7!] dhcp6 solicit (xid=7a6dce (rapid-commit) (IA_NA IAID:726689589 T1:0 T2:0) (Client-FQDN) (option-request DNS-server DNS-search-list SNTP-servers NTP-server opt_82) (client-ID uuid 14f5cb8cecbf1b91314b102ca605d75d) (elapsed-time 5818))
14:25:09.807415 IP6 (flowlabel 0xee83f, hlim 64, next-header UDP (17), payload length 160) fe80::2eb8:edff:fe5a:9d44.dhcpv6-server > sma-station12l.local.dhcpv6-client: [udp sum ok] dhcp6 reply (xid=7a6dce (server-ID hwaddr type 1 2cb8ed5a9d44) (client-ID uuid 14f5cb8cecbf1b91314b102ca605d75d) (DNS-server fd2f:4760:521f:3f3c::c0a8:45f6 dns.sse.cisco.com dns.google) (rapid-commit) (IA_NA IAID:726689589 T1:43200 T2:69120 (IA_ADDR fd2f:4760:521f:3f3c::c0a8:456d pltime:86400 vltime:129600 (status-code Success))) (status-code Success))
It would seem that the nmcli connection modify "eth0" ipv6.method dhcp command awoke DHCP6, somewhat. The DHCP6 server provided the IP and lease, tcpdump also showed success. The only part missing is that NM does not seem to care; the leased IP does show in its status list.
GENERAL.DEVICE: eth0
GENERAL.TYPE: ethernet
GENERAL.HWADDR: 00:24:8C:88:9D:F3
GENERAL.MTU: 1500
GENERAL.STATE: 100 (connected)
GENERAL.CONNECTION: eth0
GENERAL.CON-PATH: /org/freedesktop/NetworkManager/ActiveConnection/4
WIRED-PROPERTIES.CARRIER: on
IP4.ADDRESS[1]: 192.168.69.109/24
IP4.GATEWAY: 192.168.69.1
IP4.ROUTE[1]: dst = 192.168.69.0/24, nh = 0.0.0.0, mt = 100
IP4.ROUTE[2]: dst = 0.0.0.0/0, nh = 192.168.69.1, mt = 100
IP4.DNS[1]: 192.168.69.109
IP4.DNS[2]: 192.168.69.246
IP4.DNS[3]: 13.58.209.22
IP6.ADDRESS[1]: fe80::acc0:6d1f:d200:ca7e/64
IP6.GATEWAY: --
IP6.ROUTE[1]: dst = fe80::/64, nh = ::, mt = 1024
Hmm. No gateway. No leased IPv6.
# nmcli connection modify eth0 ipv6.gateway 'fd2f:4760:521f:3f3c::c0a8:4501'
Error: Failed to modify connection 'eth0': ipv6.gateway: gateway cannot be set if there are no addresses configured
(Sigh) Catch 22.
The DHCPv6 exchange is succeeding then. The SonicWall is replying with status-code Success and assigning fd2f:4760:521f:3f3c::c0a8:456d to your DUID/IAID.
The missing piece is the IPv6 default route. The Router Advertisement should provide that. Switch back to ipv6.method auto and check what Router Advertisement the SonicWall is sending, particularly its RA flags.
To do this, make sure you are back on auto…
sudo nmcli connection modify "eth0" ipv6.method auto
sudo nmcli connection up "eth0"
then run radvdump command as user dza suggested to inspect the flags the firewall is broadcasting…
sudo radvdump eth0
Where is radvdump? Not in any repo.
Install with
sudo zypper in radvd
interface eth0
{
AdvSendAdvert on;
# Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
AdvManagedFlag on;
AdvOtherConfigFlag on;
AdvReachableTime 0;
AdvRetransTimer 0;
AdvCurHopLimit 64;
AdvDefaultLifetime 1800;
AdvHomeAgentFlag off;
AdvDefaultPreference medium;
AdvSourceLLAddress on;
prefix fd2f:4760:521f:3f3c::/64
{
AdvValidLifetime 2592000;
AdvPreferredLifetime 604800;
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr off;
AdvDHCPv6PDPreferred off;
}; # End of prefix definition
}; # End of interface definition
The output you shared confirms that the RA is advertising a prefix and a default route, with both SLAAC and stateful DHCPv6 supported.
AdvAutonomous on
AdvManagedFlag on
The issue is why NetworkManager isn’t using the RA-provided default route.
Are you using this host as a router (IP forwarding turned on perhaps)? Docker or VMs in use? Please show the results from
sudo sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.all.forwarding